Splunk Search

How can I dedup across rows and columns in a pivot table?

ereed18
Engager

I have a pivot table with data, but I need to find the number of times these values occur. However, a user can input the same value in different fields causing the same value to appear on different rows and in different columns. How can I dedup across all rows and columns to return the single value and total count it occurs?

For example:

Pivot

Col1         Col2             Col3
Here         NULL             NULL
NULL         There            Anywhere
Here         NULL             Here
Here         Here             NULL
0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@ereed18 - Were you able to test out somesoni2's solution? Did it work? If yes, please don't forget to resolve this post by clicking on "Accept". If you still need more help, please provide a comment with some feedback. Thanks!

0 Karma

somesoni2
Revered Legend

Assuming you want to find the count of a specific string in all rows and columns, try this.

your current search giving output mentioned in the question 
| eval temp=1 | untable temp colname colvalue | where colvalue="YourSpecificString"
| stats count
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Brett Adams

In our third Spotlight feature, we're excited to shine a light on Brett—a Splunk consultant, innovative ...

Index This | What can you do to make 55,555 equal 500?

April 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...